pq_crypto 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dcc40bb87fcd74ce1d16bb32d99df894cb127e0c77c879cba7ec7d6ef8e099e8
-  data.tar.gz: 6baf54010794cca2d1a9f81f884f1a6db16355515f83ed1812baa57feeaf63dc
+  metadata.gz: a9f15d910879cdfa645c90795ee80932a0261322401f42e05a0623ce938cfce7
+  data.tar.gz: 126bd8e2435fedfe9aa46b046bf98215e972f9fc81d5856414015357afee6bbf
 SHA512:
-  metadata.gz: feb14e5bc0aefc8fa3b9b3d24083cd93923466d9bc1c5a1e4e527325f0290124be785da63aca97e342c9885e1e56b92e2637007a93c47d85ac950bee2317af71
-  data.tar.gz: 1a7773c9850dfea54df3897a6ee092f99258e25b0fa5393c977fa7e70c3eed309bca54044711501a6475f0d30ca56753eecaa768e87c9620a4e581b015c3332a
+  metadata.gz: 154020cb51f31d414e83c09cf9a7cc410fc8395500a97777fb741ff77986f4e5ae2fda7e64e932eaf17eb9d653901a63f114d5710a672aa5f954e756c2509898
+  data.tar.gz: c2ea78f4b001a32d486f876832832248261bf42d80ddbbe5821faed59240d6d55c80e67ed486c4476a1e47ae5fd1d46cbf64fc0903f2483ff8c3cf34c15a2388

data/.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
-        ruby: ["3.1", "3.2", "3.3", "3.4"]
+        ruby: ["3.4", "4.0"]
 
     steps:
       - name: Checkout

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.2.0]
+
+### Changed
+
+- Raised the minimum supported Ruby to the 3.4 series.
+- Switched `PQCrypto::Signature::SecretKey#sign` and `PQCrypto::Signature::PublicKey#verify` to Ruby 3.4's scheduler-aware `rb_nogvl(..., RB_NOGVL_OFFLOAD_SAFE)` path.
+- Left the faster KEM and key-generation operations on the existing lower-overhead no-GVL path.
+- Removed gem-specific scheduler configuration; runtime behavior now follows the active Ruby Fiber scheduler automatically.
+
+### Testing
+
+- Added Async integration tests that verify sibling `task.async` work keeps making progress while `sign` and `verify` run under an Async worker-pool-enabled reactor.
+- Updated CI to target the supported Ruby 3.4 series.
+
 ## [0.1.0]
 
 Initial public release.

data/README.md

@@ -35,10 +35,48 @@ bundle exec rake compile
 
 ### Native dependencies
 
-- Ruby 3.1+
+- Ruby 3.4.x
 - a C toolchain
 - OpenSSL **3.0 or later**
 
+## Async / Fiber scheduler support
+
+`pq_crypto` does not require any gem-specific Async configuration. On Ruby 3.4, `sign` and `verify` use Ruby's scheduler-aware `rb_nogvl(..., RB_NOGVL_OFFLOAD_SAFE)` path automatically.
+
+That means:
+
+- without a Fiber scheduler, these methods fall back to the ordinary no-GVL behavior;
+- with a scheduler that implements `blocking_operation_wait` (for example `Async` with a worker pool), the blocking native work can be moved off the event loop.
+
+This integration is intentionally limited to `sign` and `verify`; the faster primitive operations keep the lower-overhead path.
+
+Example with `Async`:
+
+```ruby
+require "async"
+require "pq_crypto"
+
+keypair = PQCrypto::Signature.generate(:ml_dsa_65)
+message = "hello" * 100_000
+
+reactor = Async::Reactor.new(worker_pool: true)
+root = reactor.async do |task|
+  task.async do
+    signature = keypair.secret_key.sign(message)
+    keypair.public_key.verify(message, signature)
+  end
+
+  task.async do
+    sleep 0.01
+    puts "event loop stayed responsive"
+  end
+end
+
+reactor.run
+root.wait
+reactor.close
+```
+
 ## Primitive API
 
 ### ML-KEM-768

data/ext/pqcrypto/pqcrypto_ruby_secure.c

@@ -62,6 +62,9 @@ static VALUE mPQCrypto;
 static VALUE ePQCryptoError;
 static VALUE ePQCryptoVerificationError;
 
+__attribute__((noreturn)) static void pq_raise_general_error(int err);
+__attribute__((noreturn)) static void pq_raise_verification_error(int err);
+
 static const char *pq_algorithm_symbol_to_cstr(VALUE algorithm) {
     ID id;
     if (SYMBOL_P(algorithm)) {
@@ -215,230 +218,294 @@ static void pq_wipe_and_free(uint8_t *buffer, size_t len) {
     }
 }
 
-__attribute__((noreturn)) static void pq_raise_general_error(int err) {
-    switch (err) {
-    case PQ_ERROR_KEYPAIR:
-        rb_raise(ePQCryptoError, "Keypair generation failed");
-        break;
-    case PQ_ERROR_ENCAPSULATE:
-        rb_raise(ePQCryptoError, "Encapsulation failed");
-        break;
-    case PQ_ERROR_DECAPSULATE:
-        rb_raise(ePQCryptoError, "Decapsulation failed");
-        break;
-    case PQ_ERROR_SIGN:
-        rb_raise(ePQCryptoError, "Signing failed");
-        break;
-    case PQ_ERROR_VERIFY:
-        rb_raise(ePQCryptoError, "Verification failed");
-        break;
-    case PQ_ERROR_RANDOM:
-        rb_raise(ePQCryptoError, "Random number generation failed");
-        break;
-    case PQ_ERROR_KDF:
-        rb_raise(ePQCryptoError, "Key derivation failed");
-        break;
-    case PQ_ERROR_BUFFER:
-        rb_raise(ePQCryptoError, "Buffer error");
-        break;
-    case PQ_ERROR_NOMEM:
-        rb_raise(rb_eNoMemError, "Memory allocation failed");
-        break;
-    case PQ_ERROR_OPENSSL:
-        rb_raise(ePQCryptoError, "OpenSSL error");
-        break;
-    default:
-        rb_raise(ePQCryptoError, "Unknown error: %d", err);
-        break;
+static void pq_validate_bytes_argument(VALUE value, size_t expected_len, const char *what) {
+    StringValue(value);
+    if ((size_t)RSTRING_LEN(value) != expected_len) {
+        rb_raise(rb_eArgError, "Invalid %s length", what);
     }
 }
 
-__attribute__((noreturn)) static void pq_raise_verification_error(int err) {
-    switch (err) {
-    case PQ_ERROR_VERIFY:
-        rb_raise(ePQCryptoVerificationError, "Verification failed");
-        break;
-    default:
-        pq_raise_general_error(err);
-    }
+static VALUE pq_build_binary_pair(const uint8_t *first, size_t first_len, const uint8_t *second,
+                                  size_t second_len) {
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, pq_string_from_buffer(first, first_len));
+    rb_ary_push(result, pq_string_from_buffer(second, second_len));
+    return result;
 }
 
-static VALUE pqcrypto_ml_kem_keypair(VALUE self) {
-    (void)self;
+static VALUE pq_build_algorithm_key_pair(const char *algorithm, const uint8_t *key,
+                                         size_t key_len) {
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, pq_algorithm_cstr_to_symbol(algorithm));
+    rb_ary_push(result, pq_string_from_buffer(key, key_len));
+    return result;
+}
 
+static VALUE pq_run_kem_keypair(void *(*nogvl)(void *), size_t public_key_len,
+                                size_t secret_key_len) {
     kem_keypair_call_t call = {0};
-    call.public_key = pq_alloc_buffer(PQ_MLKEM_PUBLICKEYBYTES);
-    call.secret_key = pq_alloc_buffer(PQ_MLKEM_SECRETKEYBYTES);
+    VALUE result;
 
-    rb_thread_call_without_gvl(pq_ml_kem_keypair_nogvl, &call, NULL, NULL);
+    call.public_key = pq_alloc_buffer(public_key_len);
+    call.secret_key = pq_alloc_buffer(secret_key_len);
+
+    rb_thread_call_without_gvl(nogvl, &call, NULL, NULL);
 
     if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
+        pq_wipe_and_free(call.secret_key, secret_key_len);
         free(call.public_key);
         pq_raise_general_error(call.result);
     }
 
-    VALUE result = rb_ary_new2(2);
-    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLKEM_PUBLICKEYBYTES));
-    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLKEM_SECRETKEYBYTES));
-
+    result = pq_build_binary_pair(call.public_key, public_key_len, call.secret_key, secret_key_len);
     free(call.public_key);
-    pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
+    pq_wipe_and_free(call.secret_key, secret_key_len);
     return result;
 }
 
-static VALUE pqcrypto_ml_kem_encapsulate(VALUE self, VALUE public_key) {
-    (void)self;
-    StringValue(public_key);
+static VALUE pq_run_kem_encapsulate(void *(*nogvl)(void *), VALUE public_key, size_t public_key_len,
+                                    size_t ciphertext_len, size_t shared_secret_len) {
+    kem_encapsulate_call_t call = {0};
+    VALUE result;
+    size_t copied_public_key_len = 0;
 
-    if ((size_t)RSTRING_LEN(public_key) != PQ_MLKEM_PUBLICKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid public key length");
-    }
+    pq_validate_bytes_argument(public_key, public_key_len, "public key");
 
-    kem_encapsulate_call_t call = {0};
-    size_t public_key_len = 0;
-    call.public_key = pq_copy_ruby_string(public_key, &public_key_len);
-    call.ciphertext = pq_alloc_buffer(PQ_MLKEM_CIPHERTEXTBYTES);
-    call.shared_secret = pq_alloc_buffer(PQ_MLKEM_SHAREDSECRETBYTES);
+    call.public_key = pq_copy_ruby_string(public_key, &copied_public_key_len);
+    call.ciphertext = pq_alloc_buffer(ciphertext_len);
+    call.shared_secret = pq_alloc_buffer(shared_secret_len);
 
-    rb_thread_call_without_gvl(pq_ml_kem_encapsulate_nogvl, &call, NULL, NULL);
-    pq_wipe_and_free((uint8_t *)call.public_key, public_key_len);
+    rb_thread_call_without_gvl(nogvl, &call, NULL, NULL);
+    pq_wipe_and_free((uint8_t *)call.public_key, copied_public_key_len);
 
     if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
+        pq_wipe_and_free(call.shared_secret, shared_secret_len);
         free(call.ciphertext);
         pq_raise_general_error(call.result);
     }
 
-    VALUE result = rb_ary_new2(2);
-    rb_ary_push(result, pq_string_from_buffer(call.ciphertext, PQ_MLKEM_CIPHERTEXTBYTES));
-    rb_ary_push(result, pq_string_from_buffer(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES));
-
+    result = pq_build_binary_pair(call.ciphertext, ciphertext_len, call.shared_secret,
+                                  shared_secret_len);
     free(call.ciphertext);
-    pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
+    pq_wipe_and_free(call.shared_secret, shared_secret_len);
     return result;
 }
 
-static VALUE pqcrypto_ml_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
-    (void)self;
-    StringValue(ciphertext);
-    StringValue(secret_key);
+static VALUE pq_run_kem_decapsulate(void *(*nogvl)(void *), VALUE ciphertext, size_t ciphertext_len,
+                                    VALUE secret_key, size_t secret_key_len,
+                                    size_t shared_secret_len) {
+    kem_decapsulate_call_t call = {0};
+    VALUE result;
+    size_t copied_ciphertext_len = 0;
+    size_t copied_secret_key_len = 0;
 
-    if ((size_t)RSTRING_LEN(ciphertext) != PQ_MLKEM_CIPHERTEXTBYTES) {
-        rb_raise(rb_eArgError, "Invalid ciphertext length");
-    }
-    if ((size_t)RSTRING_LEN(secret_key) != PQ_MLKEM_SECRETKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid secret key length");
-    }
+    pq_validate_bytes_argument(ciphertext, ciphertext_len, "ciphertext");
+    pq_validate_bytes_argument(secret_key, secret_key_len, "secret key");
 
-    kem_decapsulate_call_t call = {0};
-    size_t ciphertext_len = 0;
-    size_t secret_key_len = 0;
-    call.ciphertext = pq_copy_ruby_string(ciphertext, &ciphertext_len);
-    call.secret_key = pq_copy_ruby_string(secret_key, &secret_key_len);
-    call.shared_secret = pq_alloc_buffer(PQ_MLKEM_SHAREDSECRETBYTES);
+    call.ciphertext = pq_copy_ruby_string(ciphertext, &copied_ciphertext_len);
+    call.secret_key = pq_copy_ruby_string(secret_key, &copied_secret_key_len);
+    call.shared_secret = pq_alloc_buffer(shared_secret_len);
 
-    rb_thread_call_without_gvl(pq_ml_kem_decapsulate_nogvl, &call, NULL, NULL);
-    pq_wipe_and_free((uint8_t *)call.ciphertext, ciphertext_len);
-    pq_wipe_and_free((uint8_t *)call.secret_key, secret_key_len);
+    rb_thread_call_without_gvl(nogvl, &call, NULL, NULL);
+    pq_wipe_and_free((uint8_t *)call.ciphertext, copied_ciphertext_len);
+    pq_wipe_and_free((uint8_t *)call.secret_key, copied_secret_key_len);
 
     if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
+        pq_wipe_and_free(call.shared_secret, shared_secret_len);
         pq_raise_general_error(call.result);
     }
 
-    VALUE result = pq_string_from_buffer(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
-    pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
+    result = pq_string_from_buffer(call.shared_secret, shared_secret_len);
+    pq_wipe_and_free(call.shared_secret, shared_secret_len);
     return result;
 }
 
-static VALUE pqcrypto_hybrid_kem_keypair(VALUE self) {
-    (void)self;
+static VALUE pq_run_sign_keypair(void *(*nogvl)(void *), size_t public_key_len,
+                                 size_t secret_key_len) {
+    sign_keypair_call_t call = {0};
+    VALUE result;
 
-    kem_keypair_call_t call = {0};
-    call.public_key = pq_alloc_buffer(PQ_HYBRID_PUBLICKEYBYTES);
-    call.secret_key = pq_alloc_buffer(PQ_HYBRID_SECRETKEYBYTES);
+    call.public_key = pq_alloc_buffer(public_key_len);
+    call.secret_key = pq_alloc_buffer(secret_key_len);
 
-    rb_thread_call_without_gvl(pq_hybrid_kem_keypair_nogvl, &call, NULL, NULL);
+    rb_thread_call_without_gvl(nogvl, &call, NULL, NULL);
 
     if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.secret_key, PQ_HYBRID_SECRETKEYBYTES);
+        pq_wipe_and_free(call.secret_key, secret_key_len);
         free(call.public_key);
         pq_raise_general_error(call.result);
     }
 
-    VALUE result = rb_ary_new2(2);
-    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_HYBRID_PUBLICKEYBYTES));
-    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_HYBRID_SECRETKEYBYTES));
-
+    result = pq_build_binary_pair(call.public_key, public_key_len, call.secret_key, secret_key_len);
     free(call.public_key);
-    pq_wipe_and_free(call.secret_key, PQ_HYBRID_SECRETKEYBYTES);
+    pq_wipe_and_free(call.secret_key, secret_key_len);
     return result;
 }
 
-static VALUE pqcrypto_hybrid_kem_encapsulate(VALUE self, VALUE public_key) {
-    (void)self;
-    StringValue(public_key);
+typedef int (*pq_export_der_fn)(uint8_t **, size_t *, const uint8_t *, size_t, const char *);
+typedef int (*pq_export_pem_fn)(char **, size_t *, const uint8_t *, size_t, const char *);
+typedef int (*pq_import_der_fn)(char **, uint8_t **, size_t *, const uint8_t *, size_t);
+typedef int (*pq_import_pem_fn)(char **, uint8_t **, size_t *, const char *, size_t);
 
-    if ((size_t)RSTRING_LEN(public_key) != PQ_HYBRID_PUBLICKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid public key length");
-    }
+static VALUE pq_export_container_der(VALUE algorithm, VALUE key_bytes, pq_export_der_fn fn) {
+    uint8_t *out = NULL;
+    size_t out_len = 0;
+    VALUE result;
+    int ret;
 
-    kem_encapsulate_call_t call = {0};
-    size_t public_key_len = 0;
-    call.public_key = pq_copy_ruby_string(public_key, &public_key_len);
-    call.ciphertext = pq_alloc_buffer(PQ_HYBRID_CIPHERTEXTBYTES);
-    call.shared_secret = pq_alloc_buffer(PQ_HYBRID_SHAREDSECRETBYTES);
+    StringValue(key_bytes);
+    ret = fn(&out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes),
+             (size_t)RSTRING_LEN(key_bytes), pq_algorithm_symbol_to_cstr(algorithm));
+    if (ret != PQ_SUCCESS)
+        pq_raise_general_error(ret);
 
-    rb_thread_call_without_gvl(pq_hybrid_kem_encapsulate_nogvl, &call, NULL, NULL);
-    pq_wipe_and_free((uint8_t *)call.public_key, public_key_len);
+    result = pq_string_from_buffer(out, out_len);
+    pq_secure_wipe(out, out_len);
+    free(out);
+    return result;
+}
 
-    if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
-        free(call.ciphertext);
-        pq_raise_general_error(call.result);
-    }
+static VALUE pq_export_container_pem(VALUE algorithm, VALUE key_bytes, pq_export_pem_fn fn) {
+    char *out = NULL;
+    size_t out_len = 0;
+    VALUE result;
+    int ret;
 
-    VALUE result = rb_ary_new2(2);
-    rb_ary_push(result, pq_string_from_buffer(call.ciphertext, PQ_HYBRID_CIPHERTEXTBYTES));
-    rb_ary_push(result, pq_string_from_buffer(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES));
+    StringValue(key_bytes);
+    ret = fn(&out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes),
+             (size_t)RSTRING_LEN(key_bytes), pq_algorithm_symbol_to_cstr(algorithm));
+    if (ret != PQ_SUCCESS)
+        pq_raise_general_error(ret);
 
-    free(call.ciphertext);
-    pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
+    result = rb_utf8_str_new(out, (long)out_len);
+    pq_secure_wipe(out, out_len);
+    free(out);
     return result;
 }
 
-static VALUE pqcrypto_hybrid_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
-    (void)self;
-    StringValue(ciphertext);
-    StringValue(secret_key);
+static VALUE pq_import_container_der(VALUE der, pq_import_der_fn fn) {
+    char *algorithm = NULL;
+    uint8_t *key = NULL;
+    size_t key_len = 0;
+    VALUE result;
+    int ret;
+
+    StringValue(der);
+    ret =
+        fn(&algorithm, &key, &key_len, (const uint8_t *)RSTRING_PTR(der), (size_t)RSTRING_LEN(der));
+    if (ret != PQ_SUCCESS)
+        pq_raise_general_error(ret);
 
-    if ((size_t)RSTRING_LEN(ciphertext) != PQ_HYBRID_CIPHERTEXTBYTES) {
-        rb_raise(rb_eArgError, "Invalid ciphertext length");
+    result = pq_build_algorithm_key_pair(algorithm, key, key_len);
+    free(algorithm);
+    pq_secure_wipe(key, key_len);
+    free(key);
+    return result;
+}
+
+static VALUE pq_import_container_pem(VALUE pem, pq_import_pem_fn fn) {
+    char *algorithm = NULL;
+    uint8_t *key = NULL;
+    size_t key_len = 0;
+    VALUE result;
+    int ret;
+
+    StringValue(pem);
+    ret = fn(&algorithm, &key, &key_len, RSTRING_PTR(pem), (size_t)RSTRING_LEN(pem));
+    if (ret != PQ_SUCCESS)
+        pq_raise_general_error(ret);
+
+    result = pq_build_algorithm_key_pair(algorithm, key, key_len);
+    free(algorithm);
+    pq_secure_wipe(key, key_len);
+    free(key);
+    return result;
+}
+
+__attribute__((noreturn)) static void pq_raise_general_error(int err) {
+    switch (err) {
+    case PQ_ERROR_KEYPAIR:
+        rb_raise(ePQCryptoError, "Keypair generation failed");
+        break;
+    case PQ_ERROR_ENCAPSULATE:
+        rb_raise(ePQCryptoError, "Encapsulation failed");
+        break;
+    case PQ_ERROR_DECAPSULATE:
+        rb_raise(ePQCryptoError, "Decapsulation failed");
+        break;
+    case PQ_ERROR_SIGN:
+        rb_raise(ePQCryptoError, "Signing failed");
+        break;
+    case PQ_ERROR_VERIFY:
+        rb_raise(ePQCryptoError, "Verification failed");
+        break;
+    case PQ_ERROR_RANDOM:
+        rb_raise(ePQCryptoError, "Random number generation failed");
+        break;
+    case PQ_ERROR_KDF:
+        rb_raise(ePQCryptoError, "Key derivation failed");
+        break;
+    case PQ_ERROR_BUFFER:
+        rb_raise(ePQCryptoError, "Buffer error");
+        break;
+    case PQ_ERROR_NOMEM:
+        rb_raise(rb_eNoMemError, "Memory allocation failed");
+        break;
+    case PQ_ERROR_OPENSSL:
+        rb_raise(ePQCryptoError, "OpenSSL error");
+        break;
+    default:
+        rb_raise(ePQCryptoError, "Unknown error: %d", err);
+        break;
     }
-    if ((size_t)RSTRING_LEN(secret_key) != PQ_HYBRID_SECRETKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid secret key length");
+}
+
+__attribute__((noreturn)) static void pq_raise_verification_error(int err) {
+    switch (err) {
+    case PQ_ERROR_VERIFY:
+        rb_raise(ePQCryptoVerificationError, "Verification failed");
+        break;
+    default:
+        pq_raise_general_error(err);
     }
+}
 
-    kem_decapsulate_call_t call = {0};
-    size_t ciphertext_len = 0;
-    size_t secret_key_len = 0;
-    call.ciphertext = pq_copy_ruby_string(ciphertext, &ciphertext_len);
-    call.secret_key = pq_copy_ruby_string(secret_key, &secret_key_len);
-    call.shared_secret = pq_alloc_buffer(PQ_HYBRID_SHAREDSECRETBYTES);
+static VALUE pqcrypto_ml_kem_keypair(VALUE self) {
+    (void)self;
+    return pq_run_kem_keypair(pq_ml_kem_keypair_nogvl, PQ_MLKEM_PUBLICKEYBYTES,
+                              PQ_MLKEM_SECRETKEYBYTES);
+}
 
-    rb_thread_call_without_gvl(pq_hybrid_kem_decapsulate_nogvl, &call, NULL, NULL);
-    pq_wipe_and_free((uint8_t *)call.ciphertext, ciphertext_len);
-    pq_wipe_and_free((uint8_t *)call.secret_key, secret_key_len);
+static VALUE pqcrypto_ml_kem_encapsulate(VALUE self, VALUE public_key) {
+    (void)self;
+    return pq_run_kem_encapsulate(pq_ml_kem_encapsulate_nogvl, public_key, PQ_MLKEM_PUBLICKEYBYTES,
+                                  PQ_MLKEM_CIPHERTEXTBYTES, PQ_MLKEM_SHAREDSECRETBYTES);
+}
 
-    if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
-        pq_raise_general_error(call.result);
-    }
+static VALUE pqcrypto_ml_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
+    (void)self;
+    return pq_run_kem_decapsulate(pq_ml_kem_decapsulate_nogvl, ciphertext, PQ_MLKEM_CIPHERTEXTBYTES,
+                                  secret_key, PQ_MLKEM_SECRETKEYBYTES, PQ_MLKEM_SHAREDSECRETBYTES);
+}
 
-    VALUE result = pq_string_from_buffer(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
-    pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
-    return result;
+static VALUE pqcrypto_hybrid_kem_keypair(VALUE self) {
+    (void)self;
+    return pq_run_kem_keypair(pq_hybrid_kem_keypair_nogvl, PQ_HYBRID_PUBLICKEYBYTES,
+                              PQ_HYBRID_SECRETKEYBYTES);
+}
+
+static VALUE pqcrypto_hybrid_kem_encapsulate(VALUE self, VALUE public_key) {
+    (void)self;
+    return pq_run_kem_encapsulate(pq_hybrid_kem_encapsulate_nogvl, public_key,
+                                  PQ_HYBRID_PUBLICKEYBYTES, PQ_HYBRID_CIPHERTEXTBYTES,
+                                  PQ_HYBRID_SHAREDSECRETBYTES);
+}
+
+static VALUE pqcrypto_hybrid_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
+    (void)self;
+    return pq_run_kem_decapsulate(pq_hybrid_kem_decapsulate_nogvl, ciphertext,
+                                  PQ_HYBRID_CIPHERTEXTBYTES, secret_key, PQ_HYBRID_SECRETKEYBYTES,
+                                  PQ_HYBRID_SHAREDSECRETBYTES);
 }
 
 static VALUE pqcrypto__test_ml_kem_keypair_from_seed(VALUE self, VALUE seed) {
@@ -476,12 +543,9 @@ static VALUE pqcrypto__test_ml_kem_keypair_from_seed(VALUE self, VALUE seed) {
 
 static VALUE pqcrypto__test_ml_kem_encapsulate_from_seed(VALUE self, VALUE public_key, VALUE seed) {
     (void)self;
-    StringValue(public_key);
+    pq_validate_bytes_argument(public_key, PQ_MLKEM_PUBLICKEYBYTES, "public key");
     StringValue(seed);
 
-    if ((size_t)RSTRING_LEN(public_key) != PQ_MLKEM_PUBLICKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid public key length");
-    }
     if ((size_t)RSTRING_LEN(seed) != 32) {
         rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
     }
@@ -550,12 +614,9 @@ static VALUE pqcrypto__test_sign_keypair_from_seed(VALUE self, VALUE seed) {
 static VALUE pqcrypto__test_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                            VALUE seed) {
     (void)self;
-    StringValue(secret_key);
+    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");
     StringValue(seed);
 
-    if ((size_t)RSTRING_LEN(secret_key) != PQ_MLDSA_SECRETKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid secret key length");
-    }
     if ((size_t)RSTRING_LEN(seed) != 32) {
         rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
     }
@@ -588,35 +649,13 @@ static VALUE pqcrypto__test_sign_from_seed(VALUE self, VALUE message, VALUE secr
 
 static VALUE pqcrypto_sign_keypair(VALUE self) {
     (void)self;
-
-    sign_keypair_call_t call = {0};
-    call.public_key = pq_alloc_buffer(PQ_MLDSA_PUBLICKEYBYTES);
-    call.secret_key = pq_alloc_buffer(PQ_MLDSA_SECRETKEYBYTES);
-
-    rb_thread_call_without_gvl(pq_sign_keypair_nogvl, &call, NULL, NULL);
-
-    if (call.result != PQ_SUCCESS) {
-        pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
-        free(call.public_key);
-        pq_raise_general_error(call.result);
-    }
-
-    VALUE result = rb_ary_new2(2);
-    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLDSA_PUBLICKEYBYTES));
-    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLDSA_SECRETKEYBYTES));
-
-    free(call.public_key);
-    pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
-    return result;
+    return pq_run_sign_keypair(pq_sign_keypair_nogvl, PQ_MLDSA_PUBLICKEYBYTES,
+                               PQ_MLDSA_SECRETKEYBYTES);
 }
 
 static VALUE pqcrypto_sign(VALUE self, VALUE message, VALUE secret_key) {
     (void)self;
-    StringValue(secret_key);
-
-    if ((size_t)RSTRING_LEN(secret_key) != PQ_MLDSA_SECRETKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid secret key length");
-    }
+    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");
 
     sign_call_t call = {0};
     size_t secret_key_len = 0;
@@ -625,7 +664,7 @@ static VALUE pqcrypto_sign(VALUE self, VALUE message, VALUE secret_key) {
     call.signature = pq_alloc_buffer(PQ_MLDSA_BYTES);
     call.message = pq_copy_ruby_string(message, &call.message_len);
 
-    rb_thread_call_without_gvl(pq_sign_nogvl, &call, NULL, NULL);
+    rb_nogvl(pq_sign_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);
 
     pq_wipe_and_free(call.message, call.message_len);
     pq_wipe_and_free((uint8_t *)call.secret_key, secret_key_len);
@@ -643,11 +682,7 @@ static VALUE pqcrypto_sign(VALUE self, VALUE message, VALUE secret_key) {
 static VALUE pqcrypto_verify(VALUE self, VALUE message, VALUE signature, VALUE public_key) {
     (void)self;
     StringValue(signature);
-    StringValue(public_key);
-
-    if ((size_t)RSTRING_LEN(public_key) != PQ_MLDSA_PUBLICKEYBYTES) {
-        rb_raise(rb_eArgError, "Invalid public key length");
-    }
+    pq_validate_bytes_argument(public_key, PQ_MLDSA_PUBLICKEYBYTES, "public key");
 
     verify_call_t call = {0};
     size_t public_key_len = 0;
@@ -657,7 +692,7 @@ static VALUE pqcrypto_verify(VALUE self, VALUE message, VALUE signature, VALUE p
     call.signature_len = signature_len;
     call.message = pq_copy_ruby_string(message, &call.message_len);
 
-    rb_thread_call_without_gvl(pq_verify_nogvl, &call, NULL, NULL);
+    rb_nogvl(pq_verify_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);
 
     pq_wipe_and_free(call.message, call.message_len);
     pq_wipe_and_free((uint8_t *)call.public_key, public_key_len);
@@ -700,146 +735,46 @@ static void define_constants(void) {
 
 static VALUE pqcrypto_public_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                       VALUE key_bytes) {
-    uint8_t *out = NULL;
-    size_t out_len = 0;
-    VALUE result;
-    StringValue(key_bytes);
-    int ret = pq_public_key_to_pqc_container_der(
-        &out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes), (size_t)RSTRING_LEN(key_bytes),
-        pq_algorithm_symbol_to_cstr(algorithm));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    result = pq_string_from_buffer(out, out_len);
-    pq_secure_wipe(out, out_len);
-    free(out);
-    return result;
+    (void)self;
+    return pq_export_container_der(algorithm, key_bytes, pq_public_key_to_pqc_container_der);
 }
 
 static VALUE pqcrypto_public_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                       VALUE key_bytes) {
-    char *out = NULL;
-    size_t out_len = 0;
-    VALUE result;
-    StringValue(key_bytes);
-    int ret = pq_public_key_to_pqc_container_pem(
-        &out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes), (size_t)RSTRING_LEN(key_bytes),
-        pq_algorithm_symbol_to_cstr(algorithm));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    result = rb_utf8_str_new(out, (long)out_len);
-    pq_secure_wipe(out, out_len);
-    free(out);
-    return result;
+    (void)self;
+    return pq_export_container_pem(algorithm, key_bytes, pq_public_key_to_pqc_container_pem);
 }
 
 static VALUE pqcrypto_secret_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                       VALUE key_bytes) {
-    uint8_t *out = NULL;
-    size_t out_len = 0;
-    VALUE result;
-    StringValue(key_bytes);
-    int ret = pq_secret_key_to_pqc_container_der(
-        &out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes), (size_t)RSTRING_LEN(key_bytes),
-        pq_algorithm_symbol_to_cstr(algorithm));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    result = pq_string_from_buffer(out, out_len);
-    pq_secure_wipe(out, out_len);
-    free(out);
-    return result;
+    (void)self;
+    return pq_export_container_der(algorithm, key_bytes, pq_secret_key_to_pqc_container_der);
 }
 
 static VALUE pqcrypto_secret_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                       VALUE key_bytes) {
-    char *out = NULL;
-    size_t out_len = 0;
-    VALUE result;
-    StringValue(key_bytes);
-    int ret = pq_secret_key_to_pqc_container_pem(
-        &out, &out_len, (const uint8_t *)RSTRING_PTR(key_bytes), (size_t)RSTRING_LEN(key_bytes),
-        pq_algorithm_symbol_to_cstr(algorithm));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    result = rb_utf8_str_new(out, (long)out_len);
-    pq_secure_wipe(out, out_len);
-    free(out);
-    return result;
+    (void)self;
+    return pq_export_container_pem(algorithm, key_bytes, pq_secret_key_to_pqc_container_pem);
 }
 
 static VALUE pqcrypto_public_key_from_pqc_container_der(VALUE self, VALUE der) {
-    char *algorithm = NULL;
-    uint8_t *key = NULL;
-    size_t key_len = 0;
-    VALUE ary;
-    StringValue(der);
-    int ret = pq_public_key_from_pqc_container_der(
-        &algorithm, &key, &key_len, (const uint8_t *)RSTRING_PTR(der), (size_t)RSTRING_LEN(der));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    ary = rb_ary_new_capa(2);
-    rb_ary_push(ary, pq_algorithm_cstr_to_symbol(algorithm));
-    rb_ary_push(ary, pq_string_from_buffer(key, key_len));
-    free(algorithm);
-    pq_secure_wipe(key, key_len);
-    free(key);
-    return ary;
+    (void)self;
+    return pq_import_container_der(der, pq_public_key_from_pqc_container_der);
 }
 
 static VALUE pqcrypto_public_key_from_pqc_container_pem(VALUE self, VALUE pem) {
-    char *algorithm = NULL;
-    uint8_t *key = NULL;
-    size_t key_len = 0;
-    VALUE ary;
-    StringValue(pem);
-    int ret = pq_public_key_from_pqc_container_pem(&algorithm, &key, &key_len, RSTRING_PTR(pem),
-                                                   (size_t)RSTRING_LEN(pem));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    ary = rb_ary_new_capa(2);
-    rb_ary_push(ary, pq_algorithm_cstr_to_symbol(algorithm));
-    rb_ary_push(ary, pq_string_from_buffer(key, key_len));
-    free(algorithm);
-    pq_secure_wipe(key, key_len);
-    free(key);
-    return ary;
+    (void)self;
+    return pq_import_container_pem(pem, pq_public_key_from_pqc_container_pem);
 }
 
 static VALUE pqcrypto_secret_key_from_pqc_container_der(VALUE self, VALUE der) {
-    char *algorithm = NULL;
-    uint8_t *key = NULL;
-    size_t key_len = 0;
-    VALUE ary;
-    StringValue(der);
-    int ret = pq_secret_key_from_pqc_container_der(
-        &algorithm, &key, &key_len, (const uint8_t *)RSTRING_PTR(der), (size_t)RSTRING_LEN(der));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    ary = rb_ary_new_capa(2);
-    rb_ary_push(ary, pq_algorithm_cstr_to_symbol(algorithm));
-    rb_ary_push(ary, pq_string_from_buffer(key, key_len));
-    free(algorithm);
-    pq_secure_wipe(key, key_len);
-    free(key);
-    return ary;
+    (void)self;
+    return pq_import_container_der(der, pq_secret_key_from_pqc_container_der);
 }
 
 static VALUE pqcrypto_secret_key_from_pqc_container_pem(VALUE self, VALUE pem) {
-    char *algorithm = NULL;
-    uint8_t *key = NULL;
-    size_t key_len = 0;
-    VALUE ary;
-    StringValue(pem);
-    int ret = pq_secret_key_from_pqc_container_pem(&algorithm, &key, &key_len, RSTRING_PTR(pem),
-                                                   (size_t)RSTRING_LEN(pem));
-    if (ret != PQ_SUCCESS)
-        pq_raise_general_error(ret);
-    ary = rb_ary_new_capa(2);
-    rb_ary_push(ary, pq_algorithm_cstr_to_symbol(algorithm));
-    rb_ary_push(ary, pq_string_from_buffer(key, key_len));
-    free(algorithm);
-    pq_secure_wipe(key, key_len);
-    free(key);
-    return ary;
+    (void)self;
+    return pq_import_container_pem(pem, pq_secret_key_from_pqc_container_pem);
 }
 
 void Init_pqcrypto_secure(void) {

data/ext/pqcrypto/pqcrypto_secure.c

@@ -705,69 +705,60 @@ static const char PQC_OID_ML_KEM_768[] = "2.25.186599352125448088867056807454444
 static const char PQC_OID_ML_KEM_768_X25519_HKDF_SHA256[] =
     "2.25.260242945110721168101139140490528778800";
 static const char PQC_OID_ML_DSA_65[] = "2.25.305232938483772195555080795650659207792";
-
-static int pq_serialization_key_bytes_for_algorithm(const char *algorithm, int is_public,
-                                                    size_t *expected_len) {
-    if (!algorithm || !expected_len)
-        return PQ_ERROR_BUFFER;
-    if (strcmp(algorithm, "ml_kem_768") == 0) {
-        *expected_len = is_public ? PQ_MLKEM_PUBLICKEYBYTES : PQ_MLKEM_SECRETKEYBYTES;
-        return PQ_SUCCESS;
-    }
-    if (strcmp(algorithm, "ml_kem_768_x25519_hkdf_sha256") == 0) {
-        *expected_len = is_public ? PQ_HYBRID_PUBLICKEYBYTES : PQ_HYBRID_SECRETKEYBYTES;
-        return PQ_SUCCESS;
+static const char PQC_PUBLIC_KEY_PEM_LABEL[] = "PQC PUBLIC KEY CONTAINER";
+static const char PQC_PRIVATE_KEY_PEM_LABEL[] = "PQC PRIVATE KEY CONTAINER";
+
+typedef struct {
+    const char *algorithm;
+    const char *oid;
+    size_t public_key_len;
+    size_t secret_key_len;
+} pq_serialization_algorithm_t;
+
+static const pq_serialization_algorithm_t PQC_SERIALIZATION_ALGORITHMS[] = {
+    {"ml_kem_768", PQC_OID_ML_KEM_768, PQ_MLKEM_PUBLICKEYBYTES, PQ_MLKEM_SECRETKEYBYTES},
+    {"ml_kem_768_x25519_hkdf_sha256", PQC_OID_ML_KEM_768_X25519_HKDF_SHA256,
+     PQ_HYBRID_PUBLICKEYBYTES, PQ_HYBRID_SECRETKEYBYTES},
+    {"ml_dsa_65", PQC_OID_ML_DSA_65, MLDSA_PUBLICKEYBYTES, MLDSA_SECRETKEYBYTES},
+};
+
+static const pq_serialization_algorithm_t *pq_find_serialization_algorithm(const char *algorithm) {
+    size_t i;
+
+    if (!algorithm)
+        return NULL;
+
+    for (i = 0; i < sizeof(PQC_SERIALIZATION_ALGORITHMS) / sizeof(PQC_SERIALIZATION_ALGORITHMS[0]);
+         ++i) {
+        if (strcmp(algorithm, PQC_SERIALIZATION_ALGORITHMS[i].algorithm) == 0)
+            return &PQC_SERIALIZATION_ALGORITHMS[i];
     }
-    if (strcmp(algorithm, "ml_dsa_65") == 0) {
-        *expected_len = is_public ? MLDSA_PUBLICKEYBYTES : MLDSA_SECRETKEYBYTES;
-        return PQ_SUCCESS;
-    }
-    return PQ_ERROR_BUFFER;
-}
 
-static int pq_serialization_oid_for_algorithm(const char *algorithm, const char **oid_out) {
-    if (!algorithm || !oid_out)
-        return PQ_ERROR_BUFFER;
-    if (strcmp(algorithm, "ml_kem_768") == 0) {
-        *oid_out = PQC_OID_ML_KEM_768;
-        return PQ_SUCCESS;
-    }
-    if (strcmp(algorithm, "ml_kem_768_x25519_hkdf_sha256") == 0) {
-        *oid_out = PQC_OID_ML_KEM_768_X25519_HKDF_SHA256;
-        return PQ_SUCCESS;
-    }
-    if (strcmp(algorithm, "ml_dsa_65") == 0) {
-        *oid_out = PQC_OID_ML_DSA_65;
-        return PQ_SUCCESS;
-    }
-    return PQ_ERROR_BUFFER;
+    return NULL;
 }
 
-static int pq_serialization_algorithm_for_oid(const char *oid, size_t oid_len,
-                                              const char **algorithm_out) {
-    if (!oid || !algorithm_out)
-        return PQ_ERROR_BUFFER;
-    if (oid_len == strlen(PQC_OID_ML_KEM_768) && memcmp(oid, PQC_OID_ML_KEM_768, oid_len) == 0) {
-        *algorithm_out = "ml_kem_768";
-        return PQ_SUCCESS;
-    }
-    if (oid_len == strlen(PQC_OID_ML_KEM_768_X25519_HKDF_SHA256) &&
-        memcmp(oid, PQC_OID_ML_KEM_768_X25519_HKDF_SHA256, oid_len) == 0) {
-        *algorithm_out = "ml_kem_768_x25519_hkdf_sha256";
-        return PQ_SUCCESS;
-    }
-    if (oid_len == strlen(PQC_OID_ML_DSA_65) && memcmp(oid, PQC_OID_ML_DSA_65, oid_len) == 0) {
-        *algorithm_out = "ml_dsa_65";
-        return PQ_SUCCESS;
+static const pq_serialization_algorithm_t *pq_find_serialization_algorithm_by_oid(const char *oid,
+                                                                                  size_t oid_len) {
+    size_t i;
+
+    if (!oid)
+        return NULL;
+
+    for (i = 0; i < sizeof(PQC_SERIALIZATION_ALGORITHMS) / sizeof(PQC_SERIALIZATION_ALGORITHMS[0]);
+         ++i) {
+        const pq_serialization_algorithm_t *entry = &PQC_SERIALIZATION_ALGORITHMS[i];
+        if (oid_len == strlen(entry->oid) && memcmp(oid, entry->oid, oid_len) == 0)
+            return entry;
     }
-    return PQ_ERROR_BUFFER;
+
+    return NULL;
 }
 
 static int pq_encode_serialized_key(uint8_t **output, size_t *output_len, uint8_t type,
                                     const uint8_t *key_bytes, size_t key_len,
                                     const char *algorithm) {
-    const char *oid = NULL;
-    size_t expected_len = 0;
+    const pq_serialization_algorithm_t *entry;
+    size_t expected_len;
     size_t oid_len;
     size_t total_len = 0;
     uint8_t *buf;
@@ -779,15 +770,16 @@ static int pq_encode_serialized_key(uint8_t **output, size_t *output_len, uint8_
     *output = NULL;
     *output_len = 0;
 
-    ret = pq_serialization_key_bytes_for_algorithm(algorithm, type == PQC_SERIALIZATION_TYPE_PUBLIC,
-                                                   &expected_len);
-    if (ret != PQ_SUCCESS || key_len != expected_len)
+    entry = pq_find_serialization_algorithm(algorithm);
+    if (!entry)
         return PQ_ERROR_BUFFER;
-    ret = pq_serialization_oid_for_algorithm(algorithm, &oid);
-    if (ret != PQ_SUCCESS)
-        return ret;
 
-    oid_len = strlen(oid);
+    expected_len =
+        (type == PQC_SERIALIZATION_TYPE_PUBLIC) ? entry->public_key_len : entry->secret_key_len;
+    if (key_len != expected_len)
+        return PQ_ERROR_BUFFER;
+
+    oid_len = strlen(entry->oid);
     if (oid_len == 0 || oid_len > UINT16_MAX)
         return PQ_ERROR_BUFFER;
     if (key_len > UINT32_MAX)
@@ -821,7 +813,7 @@ static int pq_encode_serialized_key(uint8_t **output, size_t *output_len, uint8_
     buf[5] = type;
     buf[6] = (uint8_t)((oid_len >> 8) & 0xFF);
     buf[7] = (uint8_t)(oid_len & 0xFF);
-    memcpy(buf + 8, oid, oid_len);
+    memcpy(buf + 8, entry->oid, oid_len);
     buf[8 + oid_len + 0] = (uint8_t)((key_len >> 24) & 0xFF);
     buf[8 + oid_len + 1] = (uint8_t)((key_len >> 16) & 0xFF);
     buf[8 + oid_len + 2] = (uint8_t)((key_len >> 8) & 0xFF);
@@ -837,12 +829,11 @@ static int pq_decode_serialized_key(const uint8_t *input, size_t input_len, uint
                                     char **algorithm_out, uint8_t **key_out, size_t *key_len_out) {
     uint16_t oid_len;
     uint32_t key_len;
-    const char *algorithm = NULL;
+    const pq_serialization_algorithm_t *entry;
     size_t offset;
     size_t expected_len = 0;
     uint8_t *key_copy = NULL;
     char *algorithm_copy = NULL;
-    int ret;
 
     if (!input || !algorithm_out || !key_out || !key_len_out)
         return PQ_ERROR_BUFFER;
@@ -866,18 +857,18 @@ static int pq_decode_serialized_key(const uint8_t *input, size_t input_len, uint
     offset = 8;
     if (input_len < offset || input_len - offset < (size_t)oid_len + 4)
         return PQ_ERROR_BUFFER;
-    ret = pq_serialization_algorithm_for_oid((const char *)(input + offset), oid_len, &algorithm);
-    if (ret != PQ_SUCCESS)
-        return ret;
+    entry = pq_find_serialization_algorithm_by_oid((const char *)(input + offset), oid_len);
+    if (!entry)
+        return PQ_ERROR_BUFFER;
     offset += oid_len;
     key_len = ((uint32_t)input[offset + 0] << 24) | ((uint32_t)input[offset + 1] << 16) |
               ((uint32_t)input[offset + 2] << 8) | (uint32_t)input[offset + 3];
     offset += 4;
     if (input_len < offset || input_len - offset != (size_t)key_len)
         return PQ_ERROR_BUFFER;
-    ret = pq_serialization_key_bytes_for_algorithm(
-        algorithm, expected_type == PQC_SERIALIZATION_TYPE_PUBLIC, &expected_len);
-    if (ret != PQ_SUCCESS || (size_t)key_len != expected_len)
+    expected_len = (expected_type == PQC_SERIALIZATION_TYPE_PUBLIC) ? entry->public_key_len
+                                                                    : entry->secret_key_len;
+    if ((size_t)key_len != expected_len)
         return PQ_ERROR_BUFFER;
 
     key_copy = malloc((size_t)key_len);
@@ -886,14 +877,14 @@ static int pq_decode_serialized_key(const uint8_t *input, size_t input_len, uint
     memcpy(key_copy, input + offset, (size_t)key_len);
 
     {
-        size_t algorithm_len = strlen(algorithm);
+        size_t algorithm_len = strlen(entry->algorithm);
         algorithm_copy = malloc(algorithm_len + 1);
         if (!algorithm_copy) {
             pq_secure_wipe(key_copy, (size_t)key_len);
             free(key_copy);
             return PQ_ERROR_NOMEM;
         }
-        memcpy(algorithm_copy, algorithm, algorithm_len + 1);
+        memcpy(algorithm_copy, entry->algorithm, algorithm_len + 1);
     }
 
     *algorithm_out = algorithm_copy;
@@ -1104,7 +1095,7 @@ int pq_public_key_to_pqc_container_pem(char **output, size_t *output_len, const
     ret = pq_public_key_to_pqc_container_der(&der, &der_len, public_key, public_key_len, algorithm);
     if (ret != PQ_SUCCESS)
         return ret;
-    ret = pq_der_to_pem("PQC PUBLIC KEY CONTAINER", der, der_len, output, output_len);
+    ret = pq_der_to_pem(PQC_PUBLIC_KEY_PEM_LABEL, der, der_len, output, output_len);
     pq_secure_wipe(der, der_len);
     free(der);
     return ret;
@@ -1125,7 +1116,7 @@ int pq_secret_key_to_pqc_container_pem(char **output, size_t *output_len, const
     ret = pq_secret_key_to_pqc_container_der(&der, &der_len, secret_key, secret_key_len, algorithm);
     if (ret != PQ_SUCCESS)
         return ret;
-    ret = pq_der_to_pem("PQC PRIVATE KEY CONTAINER", der, der_len, output, output_len);
+    ret = pq_der_to_pem(PQC_PRIVATE_KEY_PEM_LABEL, der, der_len, output, output_len);
     pq_secure_wipe(der, der_len);
     free(der);
     return ret;
@@ -1143,7 +1134,7 @@ int pq_public_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out
     uint8_t *der = NULL;
     size_t der_len = 0;
     int ret;
-    ret = pq_pem_to_der("PQC PUBLIC KEY CONTAINER", input, input_len, &der, &der_len);
+    ret = pq_pem_to_der(PQC_PUBLIC_KEY_PEM_LABEL, input, input_len, &der, &der_len);
     if (ret != PQ_SUCCESS)
         return ret;
     ret = pq_public_key_from_pqc_container_der(algorithm_out, key_out, key_len_out, der, der_len);
@@ -1164,7 +1155,7 @@ int pq_secret_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out
     uint8_t *der = NULL;
     size_t der_len = 0;
     int ret;
-    ret = pq_pem_to_der("PQC PRIVATE KEY CONTAINER", input, input_len, &der, &der_len);
+    ret = pq_pem_to_der(PQC_PRIVATE_KEY_PEM_LABEL, input, input_len, &der, &der_len);
     if (ret != PQ_SUCCESS)
         return ret;
     ret = pq_secret_key_from_pqc_container_der(algorithm_out, key_out, key_len_out, der, der_len);
@@ -1174,5 +1165,5 @@ int pq_secret_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out
 }
 
 const char *pq_version(void) {
-    return "0.1.0";
+    return "0.2.0";
 }

data/lib/pq_crypto/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PQCrypto
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,29 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pq_crypto
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Roman Haydarov
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-04-20 00:00:00.000000000 Z
+date: 2026-04-22 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -173,7 +158,6 @@ metadata:
   homepage_uri: https://github.com/roman-haidarov/pq_crypto
   source_code_uri: https://github.com/roman-haidarov/pq_crypto
   changelog_uri: https://github.com/roman-haidarov/pq_crypto/blob/main/CHANGELOG.md
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -181,15 +165,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.4.0.a
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: Primitive-first post-quantum cryptography for Ruby
 test_files: []